Common Weakness Enumeration

CWE-611

Allowed

Improper Restriction of XML External Entity Reference

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

1697 vulnerabilities reference this CWE, most recent first.

GHSA-V6F7-438V-79F3

Vulnerability from github – Published: 2022-05-17 02:56 – Updated: 2022-05-17 02:56
VLAI
Details

IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1999537.

Severity
8.1 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2016-9724"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-03-07T17:59:00Z",
    "severity": "HIGH"
  },
  "details": "IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1999537.",
  "id": "GHSA-v6f7-438v-79f3",
  "modified": "2022-05-17T02:56:18Z",
  "published": "2022-05-17T02:56:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9724"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21999537"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V6M8-2842-FM7Q

Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2024-04-04 01:44
VLAI
Details

The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-14258"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-08-21T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988.",
  "id": "GHSA-v6m8-2842-fm7q",
  "modified": "2024-04-04T01:44:46Z",
  "published": "2022-05-24T16:54:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14258"
    },
    {
      "type": "WEB",
      "url": "https://www.coalfire.com/The-Coalfire-Blog"
    },
    {
      "type": "WEB",
      "url": "https://www.coalfire.com/The-Coalfire-Blog/August-2019/Getting-more-from-a-compliance-test"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V6PQ-9WMC-R634

Vulnerability from github – Published: 2022-05-24 19:17 – Updated: 2022-05-24 19:17
VLAI
Details

An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-19954"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-14T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files.",
  "id": "GHSA-v6pq-9wmc-r634",
  "modified": "2022-05-24T19:17:36Z",
  "published": "2022-05-24T19:17:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19954"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhuxianjin/vuln_repo/blob/master/S-CMS%20v3.0%20XXE%20Arbitrary%20File%20Read%20Vulnerability.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-V6X7-G9XG-9FM7

Vulnerability from github – Published: 2022-05-14 03:36 – Updated: 2022-05-14 03:36
VLAI
Details

XML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability can be exploited to allow XML External Entity (XXE)

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-6489"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-02-22T22:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "XML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability can be exploited to allow XML External Entity (XXE)",
  "id": "GHSA-v6x7-g9xg-9fm7",
  "modified": "2022-05-14T03:36:42Z",
  "published": "2022-05-14T03:36:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6489"
    },
    {
      "type": "WEB",
      "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03014426"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V6XX-62QW-537Q

Vulnerability from github – Published: 2025-09-23 00:32 – Updated: 2025-09-23 00:32
VLAI
Details

A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&style=add of the component XML Handler. Performing manipulation results in xml external entity reference. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5.5 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-10816"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-22T22:15:41Z",
    "severity": "MODERATE"
  },
  "details": "A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl\u0026style=add of the component XML Handler. Performing manipulation results in xml external entity reference. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.",
  "id": "GHSA-v6xx-62qw-537q",
  "modified": "2025-09-23T00:32:02Z",
  "published": "2025-09-23T00:32:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10816"
    },
    {
      "type": "WEB",
      "url": "https://github.com/1296299554/CVE/issues/1"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.325174"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.325174"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.654466"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-V797-6JMW-529F

Vulnerability from github – Published: 2025-03-25 15:31 – Updated: 2025-03-25 15:31
VLAI
Details

In JetBrains GoLand before 2025.1 an XXE during debugging was possible

Severity
4.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-29932"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-25T13:15:41Z",
    "severity": "MODERATE"
  },
  "details": "In JetBrains GoLand before 2025.1 an XXE during debugging was possible",
  "id": "GHSA-v797-6jmw-529f",
  "modified": "2025-03-25T15:31:29Z",
  "published": "2025-03-25T15:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29932"
    },
    {
      "type": "WEB",
      "url": "https://www.jetbrains.com/privacy-security/issues-fixed"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V7CP-2CX9-X793

Vulnerability from github – Published: 2026-05-04 20:56 – Updated: 2026-06-05 14:31
VLAI
Summary
changedetection.io project has an XXE vulnerability
Details

changedetection.io_XXE_01 Vulnerability Report: We discovered a XXE vulnerability in the changedetection.io project

While analyzing the code logic, it was determined that an area may lead to unintended behavior under specific conditions. With the project's security in mind, see the analysis results to discern whether this may indicate a potential security risk.

Overview

  • SOURCE_VERSION: 0.54.9 (9f3a9fdc18bba404244801e5df8109e213ce9ff4)
  • Vulnerability type: XXE
  • Finding title: XML XPath helpers parse untrusted XML with entity resolution left to lxml defaults
  • Affected location: changedetectionio/html_tools.py:287

Root Cause

xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).

Source-to-Sink Chain

  1. Untrusted XML/RSS response content is fetched from monitored URLs.
  2. Stream detection marks the content as XML/RSS and the include-filter path invokes xpath_filter(..., is_xml=True).
  3. xpath_filter() builds the default XML parser and calls etree.fromstring(...) at changedetectionio/html_tools.py:287.
  4. External entity declarations in attacker XML can be expanded by parser-default behavior in affected runtime combinations.

Exploitation Preconditions

  1. Attacker controls the watched XML/RSS response body.
  2. The watch uses an XPath include filter that triggers XML helper parsing.
  3. Runtime parser behavior allows external entity expansion (for example, vulnerable dependency/default combinations).
  4. The process can read the referenced local resource.

Risk

The XML helper path can turn watch processing into a local file disclosure primitive when entity expansion is enabled by parser defaults.

Impact

Sensitive local files can be exposed into extracted watch output, diff history, and downstream notification channels.

Remediation

  1. Harden XML parser construction with resolve_entities=False, load_dtd=False, and no_network=True.
  2. Reject DOCTYPE/entity declarations for untrusted XML if DTD features are unnecessary.
  3. Add regression tests that assert external entities are never expanded in XPath XML helper flows.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.2 (High)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "changedetection.io"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.54.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41895"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-04T20:56:36Z",
    "nvd_published_at": "2026-05-12T18:17:23Z",
    "severity": "HIGH"
  },
  "details": "# changedetection.io_XXE_01 Vulnerability Report: We discovered a XXE vulnerability in the changedetection.io project\n\nWhile analyzing the code logic, it was determined that an area may lead to unintended behavior under specific conditions. With the project\u0027s security in mind, see the analysis results to discern whether this may indicate a potential security risk.\n\n## Overview\n- SOURCE_VERSION: `0.54.9 (9f3a9fdc18bba404244801e5df8109e213ce9ff4)`\n- Vulnerability type: `XXE`\n- Finding title: `XML XPath helpers parse untrusted XML with entity resolution left to lxml defaults`\n- Affected location: `changedetectionio/html_tools.py:287`\n\n## Root Cause\n`xpath_filter()` switches to XML mode for XML/RSS content and creates `etree.XMLParser(strip_cdata=False)` without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with `etree.fromstring(...)`.\n\n## Source-to-Sink Chain\n1. Untrusted XML/RSS response content is fetched from monitored URLs.\n2. Stream detection marks the content as XML/RSS and the include-filter path invokes `xpath_filter(..., is_xml=True)`.\n3. `xpath_filter()` builds the default XML parser and calls `etree.fromstring(...)` at `changedetectionio/html_tools.py:287`.\n4. External entity declarations in attacker XML can be expanded by parser-default behavior in affected runtime combinations.\n\n## Exploitation Preconditions\n1. Attacker controls the watched XML/RSS response body.\n2. The watch uses an XPath include filter that triggers XML helper parsing.\n3. Runtime parser behavior allows external entity expansion (for example, vulnerable dependency/default combinations).\n4. The process can read the referenced local resource.\n\n## Risk\nThe XML helper path can turn watch processing into a local file disclosure primitive when entity expansion is enabled by parser defaults.\n\n## Impact\nSensitive local files can be exposed into extracted watch output, diff history, and downstream notification channels.\n\n## Remediation\n1. Harden XML parser construction with `resolve_entities=False`, `load_dtd=False`, and `no_network=True`.\n2. Reject `DOCTYPE`/entity declarations for untrusted XML if DTD features are unnecessary.\n3. Add regression tests that assert external entities are never expanded in XPath XML helper flows.",
  "id": "GHSA-v7cp-2cx9-x793",
  "modified": "2026-06-05T14:31:13Z",
  "published": "2026-05-04T20:56:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-v7cp-2cx9-x793"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41895"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dgtlmoon/changedetection.io"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/changedetection-io/PYSEC-2026-29.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "changedetection.io project has an XXE vulnerability"
}

GHSA-V837-QC8G-228C

Vulnerability from github – Published: 2022-07-13 00:00 – Updated: 2022-07-21 00:00
VLAI
Details

Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rendering the system temporarily inoperative.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-35168"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-12T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rendering the system temporarily inoperative.",
  "id": "GHSA-v837-qc8g-228c",
  "modified": "2022-07-21T00:00:27Z",
  "published": "2022-07-13T00:00:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35168"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/3211203"
    },
    {
      "type": "WEB",
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V83V-8PQ8-XR74

Vulnerability from github – Published: 2022-05-14 03:06 – Updated: 2022-05-14 03:06
VLAI
Details

netbeans-mmd-plugin version <= 1.4.3 contains a XML External Entity (XXE) vulnerability in MMD file import that can result in Possible information disclosure, server-side request forgery, or remote code execution. This attack appear to be exploitable via Specially crafted MMD file.

Severity
7.8 (High)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-1000542"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-06-26T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "netbeans-mmd-plugin version \u003c= 1.4.3 contains a XML External Entity (XXE) vulnerability in MMD file import that can result in Possible information disclosure, server-side request forgery, or remote code execution. This attack appear to be exploitable via Specially crafted MMD file.",
  "id": "GHSA-v83v-8pq8-xr74",
  "modified": "2022-05-14T03:06:31Z",
  "published": "2022-05-14T03:06:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000542"
    },
    {
      "type": "WEB",
      "url": "https://github.com/raydac/netbeans-mmd-plugin/issues/45"
    },
    {
      "type": "WEB",
      "url": "https://0dd.zone/2018/06/02/Netbeans-MMD-Plugin-XXE"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V868-4M83-H5W3

Vulnerability from github – Published: 2026-06-30 21:31 – Updated: 2026-06-30 21:31
VLAI
Details

IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-13449"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-30T20:17:28Z",
    "severity": "HIGH"
  },
  "details": "IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.",
  "id": "GHSA-v868-4m83-h5w3",
  "modified": "2026-06-30T21:31:44Z",
  "published": "2026-06-30T21:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13449"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7278532"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Implementation System Configuration

Many XML parsers and validators can be configured to disable external entity expansion.

CAPEC-221: Data Serialization External Entities Blowup

This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

← Back to the CWE list